A company is using an organization in AWS Organizations to manage multiple AWS accounts.

A Lambda function in one account can mount a file system in a different account. For this scenario, you configure VPC peering between the function VPC and the file system VPC. https://docs.aws.amazon.com/lambda/latest/dg/services-efs.html

https://aws.amazon.com/ru/blogs/storage/mount-amazon-efs-file-systems-cross-account-from-amazon-eks/

1. Need to update the file system policy on EFS to allow mounting the file system into Account B.

## File System Policy

$ cat file-system-policy.json

{

"Statement": [

{

"Effect": "Allow",

"Action": [

"elasticfilesystem:ClientMount",

"elasticfilesystem:ClientWrite"

],

"Principal": {

"AWS": "arn:aws:iam:::root" # Replace with AWS account ID of EKS cluster

}

}

]

}

2. Need VPC peering between Account A and Account B as the pre-requisite

3. Need to assume cross-account IAM role to describe the mounts so that a specific mount can be chosen.